Should you be concerned about cyberwar?

In all seriousness. I don't think that a "cyberwar" could really be THAT bad. I mean, we haven't always used computers. There's still a lot of people that know how to work without one. The net is more of a convenience factor, not a necessity. And if some lamer terrorist wants to drop the net, so be it. All it's really going to do is piss off a bunch of online gamers and inconvenience the business world. And the AOL crowd won't be able to "chat". The rest of us will just head back to dialup and continue doing what we do, just a little bit slower;)

Not to mention, I'm sure there are tons of networks that are unsecure, but I would assume that majority of the networks are safe and would be able to withstand an attack.

The press, in my opinion, is just looking to ruffle some feathers and spark up paranoia in people. And from some articles I have seen, they are succeeding at this time. But I think that it's all just a bunch of hokey crap.

Personally, I think that there are more important things to worry about than a "cyberwar". hehehaha

Mrafrohead

While it is not possible to bring down the net.

Cyber-terrorism is a real factor in national security.

It's not the "hey we just brought down a bank", it's more of terrosists targeting key national cyber targets.

i.e. Stock Marcket (nasdaq,NYSE), Large Banks, DoD, NASA, Nuclear Reactors, Silo's, etc.

Terrorists that makes those things there targets have a multi-level agenda. Bring down the stock market and not only did you just disrupt the market. You have erroded investor confidence and shaken the stability of the global financial market.

Bring down national gov't and you just eroded our countries strength.

A large coordinated DoS attack on *any* network, secure or not, will bring it down to it's knees.

This is just reality.

If a well funded terrorist group brought down all of the DNS root servers in one fail swoop. That would cause widespread dissepation of the net.

There are millions of companies that rely on the net for their living. Including the one I work for.

While it is nearly impossible for terrorists to bring down all of the backbone providers via electronic means. Physically blowing up certain key POP's can have severe consequences for the net.

We no longer live in a society that can be sustained without the use of computers.

It is not possible in todays modern world.

While it is a nice idea to be able to live without them and go back to a time that we were not all connected. It is not possible any more.

The world society on a whole is too dependant on the machine to give it up.

Entire business lines depend on the net to keep their corporations connected and going.

The financial community is extremely dependant on real-time information.

The problems of accounting and data harvesting that once plagued the business world have been solved by computers. Enabling them to thrust their business into regions once unattaneable.

It is not possible to turn back. Which is why any attack percieved or real must be dealt with.

I don't install a firewall to protect my network for the possibility that I may one day, if i'm lucky, be attacked. I install it to prevent the attack from happening when it does happen.
This was the same philosophy when I was with the Rangers. We did not train for war in the event that we may one day go to war. We trained with the thought that we were going to war, today, tommorow or the next day. We trained hard to make sure we were ready. To stay strong so that we may be used as a detterent to war.

Why? Because in WWII we established ourselves as a world leader. Once that happened we can never go back.

It's the same with computers.

Hello all,
here is my take on the situation. It is my observation that the main way of disabling the net is by DoS or DDoS attacks. There are, of course, other methods but these seem to be the most capable. Now, I must ask, in this age of technological wizardry and hundreds of thousands (maybe millions) of programmers and technology gurus, should this still be a problem? I, in my limited knowledge, can not come up with a solution. However, it seems hard to imagine that with the pool of abilitysomeone hasn't developed a system to notice these attacks before they take hold. As I say, maybe I am expecting too much. Is there a way for the server to recognize a large flood of packets being sent at one time and reject them? Or by rejecting them is it already too late? Or is this a built in flaw in the TCP/IP protocol? I am a person who always sees room for improvement. I am sure there is a solution we just haven't found it yet.

"Cyber Terrorism" was coined by Barry C. Collin of the Institute for Security and Intelligence.

Source: http://tinyurl.com/4dum

(Of course, Al Gore probably took credit for that too, just like he took credit for scores of things accomplished by others.)

"A good overview by the man who coined the term "Cyber Terrorism" is The Future of CyberTerrorism: Where the Physical and Virtual Worlds Converge, written by Barry C. Collin of the Institute for Security and Intelligence."

http://www.nipc.gov/

A Message from Ron Dick, (former) Director of the National Infrastructure Protection Center

"Our society is increasingly relying on new information technologies and the Internet to conduct business, manage industrial activities, engage in personal communications, and perform scientific research. While these technologies allow for enormous gains in efficiency, productivity, and communications, they also create new vulnerabilities to those who would do us harm. The same interconnectivity that allows us to transmit information around the globe at the click of a mouse or push of a button also creates unprecedented opportunities for criminals, terrorists, and hostile foreign nation-states who might seek to steal money or proprietary data, invade private records, conduct industrial espionage, cause a vital infrastructure to cease operations, or engage in Information Warfare."

Jonathan Yarden is either extremely ignorant on the implications of such things or very na?ve on what's a realand/or perceived threat.

What are critical infrastructures, and why are they important?

"The United States is in the midst of a tremendous cultural change -- a change that affects every aspect of our lives. The cyber, or information age, dimension promotes accelerating reliance on our infrastructures -- telecommunications, electrical power, gas and oil storage and delivery, transportation, banking and finance, water supply systems, emergency services (including medical, police, fire, and rescue), and government operations -- and offers access to them from all over the world, blurring traditional borders and jurisdictions. National defense is not just about government anymore, and economic security is not just about business. The critical infrastructures are central to our national defense and our economic power..."

http://www.nipc.gov/about/about5a.htm

How many people have read the article in question?

Does anyone have a link to the article?

I get dozens of e-newsletters from TechRepublic every day. I might even read one of them once in a while.

Anyone who thinks that cyberterrorism isn't a real threat, except maybe that it will inconvenience us - truly doesn't either understand the technology of this country's infrastructure or just isn't thinking deep enough.

I also think it doesn't really matter what you say your company has it place for backup or what hardware safe guards you have - if the horrible day really comes and you work for a huge company that is a great mark (ie. like a government agency, a stock exchange, major utility, etc.) if "they" want to bring your network down it will be brought down.

Because I hate to admit it but if you think realistically, ok now we were attacked on our own soil (9/11) -- the world knows the times we live in, they now how "advanced" the USA is with computers, etc. Its only logical to me that not only will cyberwar be a tool used more and more but terrorists will PHYSICALLY attack technology key points.

You can try and guard your network from hackers, but what about a 1500 pound fuel air bomb?

Sure blankets work wonders when you're out of power. But being without power can create other problems.

First of all, your water company may also be without power. So it becomes rather hard to get water for cooking, washing or flushing the toilet.

Second, the sewage system may be without the pumps needed to get the sewage past certain choke points. This means that some people will have sewage backing up and flowing into their houses if they are unlucky enough to be 'downhill' from the pump assisted choke points.

Third, you may find that your job doesn't pay you if there isn't any power. So even if you have the low tech means to survive the lack of power, you might end up losing it because you can't pay the bills.

Now you could have backup power sources for everything. But they cost money to install and maintain and they may not be feasible for power hungry businesses. And if the power outage lasts too long, they may not be enough.

I don't know how many times this came up towards the end of last year in conversations. IT workers have become much more important and whether or not it's: "fodder for sensational media" it's keeping people employed and the IT equipment product chain in business. Before the threat of war and Homeland Security no businesses were really updating or buying anything. Towards the end of the year they started putting money back into IT again, especially security and security devices. Why? it's their patriotic duty, not to mention that no business can afford to be lax in security now, it's not just their own... it's NATIONAL security!

:)

(physical)over virtual security.

If someone bought a lot of beans and produced a pound or so of ricin, then payloaded some model rockets and sent them over Washington during a public address, the immediate and long term consequences would be immense.

Someone could easily launch these outside the security area. Not spot on targeting (although with a model plane you could get within 50 feet or closer with a cheap gps although it would probably get shot down over a crowd instead) but potentially terrifyingly effective.

We keep thinking high tech in our high tech world, but it's those creative and adept with low tech and living in incredible desperation that I fear. I can think of hundreds of low tech scenarios that would be far more serious than anything that could be done high tech, although I do not discount that the effects of a high tech attack could be grave, I would worry more about low tech.

Cyberwar is a populist and fear mongering view to sell copy.
But the threat of it has made us aware of the possibilities, we should now be wiser and more cautious. We have learned to lock our doors. If by now you haven?t done your homework and implement security on your systems, you shouldn?t be on the internet at all.
I also think that terrorists themselves rely on the internet to communicate, as much as phones or snail mail.

I don't fear cyberwar. I fear laws passed to "protect" us from it. Death for hackers... is a little extreme (most murders don't get life). Keep your eye on the Department of "Fatherland" security. Those that ignore history are destined to repeatit.

Loss of power will not destroy us all. I recently went through a winter ice storm that put more people out of power then Hurricane Hugo (over 2 million without power). I wasn't fun, and I personally went 8 days with no power, my biggest problem was what do with my animals.

Business will not end, please revisit "ancient" technologies like phone, fax, and manual order entry. Again, not fun, but it can be done. Our diesel generator/battery backup failed at work (bad alternator, yes wetested, but never long enough to see if the generator was recharging the batteries) so we brought in personal generators to compensate. If your business model can't survive without the Internet, you better diversify (800 number).

DNS servers and airports, sure they could be attacked (they've been probed several times). But can terrorists muster the resources (you will have to take them all down for extended period of time).As for airports, there is a reason radar stations overlap and not all ground stations are attached to airports. Physical peering points might be a good place to attack (backhoe reference) but no dead bodies, no shock value.

Counterterror students know, operations that have the highest probability of success are simple (KISS principle). Cyberwar not "simple", and Mr. Murphy (of Murphy's law fame) will have a field day with cyberwar plans. Traditional terrorists prefer violence of action ( like our SpecOps). If the end result is not splashed all over the world wide media then its not worth pursuing. What do you hear from the middle east, hacked websites or suicide bombers (there have been plenty of both, and their power grid is still u

The whole world revolves around power, influence and anything connected to it. We want to feel secure, satisfied and fulfilled. Many will do anything to gain respect, acceptance or power.

With these 2 things in mind, we have to wonder where to draw the line between freedom with protection - and suppression and paranoia. No one is safe from any form of terrorism.

With every new technology comes constructive and destructive uses. Always there is those who use it to exert power, and those who use it to heal, build and advance.

It is because of fear that people destroy each other. It is because their sense of morality and humanity has been corrupted by the influences and events of this cruel world (that WE created) - that is why CyberTerrorists exist; why any terrorist exists.

There will be no end to it; the Cyber War. There will always be "us" and there will always be "them". They can't have what they want, so they destroy and hurt to get it. We get offended and threatened because of lack of knowledge and skills, so we build our walls of defenses and do the same in the end - just in another way.

Instead of dwelling on thoughts of "how are we going to defend ourselves" and "what if they...", we should think and act onthe following: "How can we make a difference?"

Why fear? Why give terrorists the "kick" or whatever they want? Don't fight them! Convert them! It is the best hackers and crackers in the world that produce the best security solutions!
If we can'tbeat 'em, we don't have to join 'em. We just have to learn from their ways, and use it against them. We can do so by getting their own kind to handle their own kind.

Fire is best fought with what sustains it - combustables (as the saying fight fire with fire) . Wind is stopped by what causes wind - high and low pressure systems. It is a natural law, like a physics law. Shall we yield it? Or be yielded by it?

if they don't have a big stock of food, a septic tank, wood stove and some back-up solar panels... but you can still survive with a gun, a garden and compute WITHOUT the internet for a couple of hours a week with a battery and solar panel. I have friends in north Idaho that live on Amateur Radio, Wood, and their own little hydroelectric system on 40 acres.... the only effect there is that work would shut down and that wouldn't be so bad for a while.

We can go to our cabins and relax and watch the river flow by. Sounds like a nice break from fixing systems that fail mostly from their interconnections.

I bet some towns in Idaho would not be affected much at all... there's no public power etc. in a lot of places here still (including small towns), and people live fine... (They actually say they live "very well" if you ask them)

I guess I could expand "neighbors" to people from other places... those new bands of wandering "Mad Max" gangs, but we don't really have that much gasoline here, besides, all the populated areas would find it much easier to hunt down some Soylent Green than try to hang out in the wilderness as far as I can tell.

It seems like some of this discussion is panic oriented. To do the damage of some of these scenarios, a terrorist would be better off smuggling in an EMP generator that would destroy everything with silicon in a city like the Clooney/Vegas movie. (In the real world, is this possible with anything less than a nuke?)

It's hard to judge the cyberterror threat. Clearly the government has already acted out "the little boy who cried wolf" on multiple occasions. Some kid defaces a Navy web site and officials cry "cyberterrorism". Nonsense. That's equivalent to spraypainting the windows of a recruiting office. But the "cool hacks"? If business is loath to publicize when they've been hacked, what are the odds we will hear about a successful defense department hack?

With the venue of technology into every modern country armies, we are all facing a revolution in military affairs. This affects not only our equipments, but as well if not more our doctrine, and our way to fight.

Cyberwar is about protecting oursystems at the same time as we try to inflict damage to the oposing force's systems. The side that will be able to affect the other's system first will most likely avoid damage to his own. Doing things this way will then help sustain our capabilities to fight with our high-tech equipment.

Terrorism is at the base of what is called assymetric warfare. In essence, it is only a variant of the the fighting we are already use to. True, it is far more complex to deal with for obvious reasons, butthis kind of fighting is very well suited to cyberwar.

It is not only a treath to our military forces, but as well to every major company. Economy is a nation's critical asset.

The real technical impacts or lack of capability following theseattacks may be of insignificant importance. Everything as to do with the goal set by the terrorists. If they aim at inflicting a lack of capability to the governments, they probably won't succeed (because of systems redundancy, etc..) and it will most than likely stay unknown anyway.

The choice then is to bring fear and lack of confidence into the attacked systems, and/or company....possibly affecting economy.

The side effects of very well organized, systematic actions could potentiallyhave serious effects, more than the technical aspects as such.

All modern country had made a choice to use technology as a way to work because of the definite benefits of doing so. We can't just go back...so we must insure that we will be able touse our technology.

I am a canadian military officer currently studying computer science at university. I am also a Royal Military College of Canada graduate from the applied military science department. And I am currently taking a course on science and war: the impactof technology on war.

I was also part of the emergency reaction unit during the big ice storm that affected Canada in january 1998. Some farmer lost animals because of the lack of power, directly affecting the food production. City people were not equiped to deal with this situation, most of them needing electricity to heat their house. Wood became a critical issue very quickly, people running out of it.

More than 6000 people had to be taken care of in scools and temprary shelters. Think about the logistical burden of caring for those people, feeding them, and occupying them. Flu and colds became an issue among those groups.

It took about 15 000 soldiers and thousands of police officers to control the situation.

It was a natural catastrophy, but a cyber attack causing the same kind of results would have had cause a serious burden to the autorities on a smaller scale.

All that to say that if forced to, we would revert to the way it was 300 years ago, but with a number ofcasualties we don't want to live with.

Wouldn't you think that if some one were to actually carry out a cyberterror attack, that it would have happened already? Besides, the lowly terrorists plaguing the world today care nothing about material possessions, their own lives, or financial data for that matter. Sure a well placed byte here or their in a person's financial records can wreak havoc and may take years to mend, but the situatuion is reparable. Death is not. Death is all that matters to the terrorists from their leaders to the jerk who believes that there are virgins waiting for him in heaven.

Remember just a few short years ago how the Y2K bug was hyped to frenzy where governments and corporations all over the world spent billiions of dollars to "fix"? Do you recall seeing "Y2K OK" stickers plastered on everything that used electricity? Fooled weren't we all!

Not this time.

Actually, some of us still have books as sort of a backup for the stuff on the PC. While they may not be up to the minute as far as information is concerned, they can function when the power is out and they don't need a high tech reader.

Furthermore, they can be used for such things as holding up tables, weighing down objects and other tasks that require compressive strength and/or mass.

And in a dire emergency, they can be sacrificed as ersatz firewood and crude toilet paper.

I swear that when I read some of the newspaper and magazine articles, they are reprinting old Y2K stories, after doing a global search and replace with CyberTerrorism in the place of Y2K.

Yes, there is a potential for the infrastructure that relies on the internet to fail, but guess what? When things fail, there are always fallbacks -- paper forms instead of electronic, typewriters instead of word processors. Also, very few of the worm / virus writers have political motives -- to them it is more of a challenge than anything else.

There is more danger from the smallpox vials that are missing from Russia than there is from cyberterrorism. Just think - an aerosol of smallpox viri released into the air conditioner of an international flight. How long would it be before there was a pandemic?

If we worry so much that we do not have a life, then the goal of any terrorist organization has been achieved.

So I am clear, you are saying that the 2K BUG was in fact a hoax. Brought about by people who wrote and bought sub-standard software?

And instead of them admitting that they bought sub-standard software they created this "hoax" to scare the general public?

If you choose not to believe that there was a programming error, that's fine. It's your choice.

But to condemn those people for playing it safe, reviewing their code and making the necessary changes is not a fair thing to do.

I would call it irresponsible if critical services did not review and repair their code. I know my company reviewed their code and also verified that each piece of software was not susceptible to the date issue. And we did find some software that wasnot up to snuff.

A quick check with the vendor to get their latest release fixed it. Do I consider it poorly written software, NO. Even the programmers I worked with at the time said that only putting in 2 fields for the year was a standard practice. No one really thought about it until later on when computing started to advance.

A phrasing change? How about a reality check?

Which of the following is most likey to kill an American today:

An automobile accident.
A weather related auto crash.
A plane crash.
A weather related plane crash.
A plane crash caused by a Stinger missle which we supplied to some guerilla group.
Twelve empty chemical warheads in Iraq.
A distributed denial of service attack on all of the root DNS servers.

Interestingly enough, one of the big BBS's around here was ran by a local county sheriffs department and was had security problems. That they would run an open BBS at all always struck me as interesting.

Anyway, it would seem that law enforcement would be most secure, but apparantly not necessarily.

I was also amused by people suckered in by Y2K fear mongering, especially those who went the survivalist route and stocked up on supplies for when the lights went out.

On the other hand, knowing a bit about the evolution of business software, I have to disagree with your comments about sub-standard software. In many instances, the sub-standard software was legacy software that dates back to when storage was on punch cards and the extra couple of bytes for a Y2K compatible year had a major impact on processing.

When storage costs dropped, the potential problem wasn't corrected because 'everybody knows' that they'll be using different software when Y2K comes. And even if wiser heads prevailed on the IT side, many of the accountants ignored suggestions because there were projects with bigger paybacks.

Heck, when I worked on an asset ledger project in 1983, I was criticized for worrying about the year 2000 problem. But, being stubborn, I made my code Y2K compatible long beforeY2K became a battle cry.

cyber attack is not the true issue. of course a 9/11 dos attack would be spectacular ... but the real issue would be manipulation and degradation of services.
e.g. to manipulate bank algorithms connected to basel 2.
a digital pearl harbour can be recognized as such and recovered from - manipulation will slowly bring parts of our "western" economy to it's knees and we will not even know about.